PT-2016-1304 · Moodle · Moodle

Ankit Agarwal · Published 2015-12-05 · Updated 2022-05-13 · CVE-2015-5338

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.6.11 Moodle versions 2.7.x before 2.7.11 Moodle versions 2.8.x before 2.8.9 Moodle versions 2.9.x before 2.9.3

Description The issue is related to multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module of Moodle. These vulnerabilities can be exploited by a remote attacker to gain access to the authentication data of arbitrary users. The exploitation involves requests to specific API endpoints, such as "mod/lesson/mediafile.php" or "mod/lesson/view.php".

Recommendations For versions prior to 2.6.11, update to version 2.6.11 or later. For versions 2.7.x before 2.7.11, update to version 2.7.11 or later. For versions 2.8.x before 2.8.9, update to version 2.8.9 or later. For versions 2.9.x before 2.9.3, update to version 2.9.3 or later. As a temporary workaround, consider restricting access to the "mod/lesson/mediafile.php" and "mod/lesson/view.php" API endpoints until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2016-00601

CVE-2015-5338

GHSA-V33X-Q8GH-4X42

MGASA-2015-0464

Affected Products

Moodle

References · 28

• https://moodle.org/mod/forum/discuss.php?d=323233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5338 · Security Note
• https://advisories.mageia.org/MGASA-2015-0464.html · Security Note
• https://ubuntu.com/security/CVE-2015-5338 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0464 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00601 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5338 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5338 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v33x-q8gh-4x42 · Vendor Advisory
• https://github.com/moodle/moodle/commit/f75333766c7295932baa72a9dbe9542baf14e107 · Note
• https://github.com/moodle/moodle/commit/541c5b8552e0162010d0259c90a04eb63e875958 · Note
• https://github.com/moodle/moodle/commit/817cae1ac7ca748ba368439a40ef67d555774485 · Note
• https://github.com/moodle/moodle/commit/dcb42c9ed13b0c0ec2dde22b62ef69772d7725e6 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48109 · Note
• https://bugs.mageia.org/show_bug.cgi?id=17280 · Note